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1* ATSA-04 has been engaged over the last several nonth* In an 
analysis of AF3A oon*rt«ilc»tion» fbr the jporpose of detersdning the typo# 
«nd ctteii*iv«n«ao of inforastlon potentially available to foreign traffic 
analysis through similar stull™. Poluninou* anounts of details! technical 
data heve boon ooapUed, and consolidation of tha material into * final 
«6n$l«t« report ha* provon eo tiae-con evedng that a mtm&ry report of 
findings la considered easontlal cod i» contained herein. The detailed 
nporl, ebon coapletvd, dll serve chiefly u reference material for 
fetors studies. The etudy 1* baeod primarily os analyeie perf onasd on 
all noceagea handled between the APSA precasting center and intercept 
a«tMU«« during the period 15 Jane - 15 July, 1550. (A volas® breakdown 
by originating etation during the base period of study is attached as 
Xacle sure 1.) Xhaamwrh ae APSA eosssttfticstion procedure* hare regained 
baeieally unchanged, findings baeod on traffic of that period ere gener- 
ally true ef the situation at present . The report alao incorporates 
rea ults ef subsequent spot checks on the sane traffic, and results of 
continuous review ef traffic handled at the AR 5 and KSS eontmnieatlone 
•enters. 

xx« xmm op otaract^istxcs op mracsTT numc 

4* the eowsuoieatione of AfkA would gain the attention of foreign 
traffic analysts In the eouree of elesaatary studies of 0. a. military 
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•OaMKinlcatlon*. Puch attadl*» would eeteil *♦£?*£* tien of encrypted truffle 
ca&trtud *harfcct«ri»ticB. It weald 1 m noted that a dletlnotlv* general 
^ntm, «hflTAct«rl»tKl teer an wight letter n##*age indicator, contain* the 
ract balk of *11 encrypted traffic *f the araod Fore-*, and that wall aver 
of th* traffic la tbl* ayeteai 1* routed to U£#S3, which own be Identi- 
fied a* Arlington Hall station. The originator* of title traffic arc dealg- 
Mated on each sassa?* by Means of fixed sddrtas groups, Tfeeee *a*e origin*- 
tears tend end receive eese&ge* In other general eyetaras with rout in- to UEFA# 
er Bsnr. A number of eharactariatiee inherent in B/ 1 activity are evident in 
AFSA eoaeamleatiens. Jaaong those arei 

(a) Ike worldwide nature of the organ last ion o*» be 
determined easily by eryptonet reconstruction, 

(b) the volume of traffic la the eryptenet le extreaely 
heavy (60~$5£ of all A»ed farces encrypted traffic). 

(e) frantically ell of the traffic la routed to or from 
MO# central location. Identifiable a* Arlington Hall 
fiction. 

(d) iVeffie flew la alaoei entirely unidirectional (99% 
into Arlington). 

(e) Technical nature of the traffic le India eted by nor.- 
aenfbraanee to command channel* a* eppocod to norxsol 
eoaeand, adodnist relive or operation*! traffic. 

(t) large weluwte originate free location* which are 

a p par ently act of adequate Military idgnifieane* to 
iMerraat ouch volute*. 
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Cf) Occasional pl*ift-lsh£tt*£e <tt*elo«ur«a occur vhtch 
eentaln phrasea *uch u *m traffic/ cr even 
unencrypted intercepts, 

toal/iib of data leading to eetabliehewnt of thee* characteristics 
inevitably result* In conclusions that AfSA intercept traffic eon bo identi- 
fied a* each. These cone lue ions are substantiate! by eaelty accessible 
collator *1 infon-etion. Specific oporatiag practices which either provide 
additional fubetantiating orldenee or or* potential oearcoo of further 
insecurity ora eeperately considered below, 

S, Control corial anchors. The practice, peculiar to intercept 
traffic, of ttalng a apodal sot of aerial msebora externally to old In 
aclatalnlng continuity of traffic flow, la ceaddorod to provide eneny inter* 
a apt with a definite ail la checking continuity of hie intercept, or if ho oo 
deeires, a aeons of checking ear intercept rohma with a ed nl am m of effort, 
b* Ter table *yetew indicator*. Siren food Intercept eeverage and 
a bade knowledge of Intercept operation#, there la evidence to indicate that 
the variable indicator ayetao can be wived end that traffic originated by 
individual at at ion* mj be oategoriaed into the traffic types represented by 
the variable indicator*, Then ttd* 1* aacoaplished, it le poetible to seaport 
one station again* t another with respect to general intercept co ntr ol ebjec- 
tire#, interest t^UHUw •* individual stotlene, ot*. nth exceptionally 
good coverage by foreign intercept, rach information i« need to reveal the 
Significance of traffic total* resulting from event « of international impor- 
tance, thus defining olaelone aero clearly and reflecting 0 , 3, intelligence 
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for example, a study of| Jtotala Immediately before and 

*tt«r th« invasion of South Seraa reveals that that station took tha lead la 
Interception of forth foroan aliitary circuit a. Although 0, a. intelligence 
re-alracant* are ohrloua In title cm«, situation# ■ay arise In the future Involv- 
ing U. 5, intnlllgonce ro-juircaent* which era leea obvloua* and eould ba 
revualed only through fluctontiona in A/3 A to tala, foan the fenaral mission 
act a given installation la known trr suspected, farther details, including the 
specific eireulta monitored* might be obtained by manipulation of traffic flow 
on foreign circuits and observation of effect* on raw traffic totals* Khan 
detail* of intercept control have bean reconstructed to the point that apeeifie 
target* are identified* it is conceivable that inferencea may be drawn regarding 
exploit ability of foreign traffic, 

#• Cell eigne and addressing information. Ample evidence la fsreaant 
to permit general ldenti float Ion of activities involved* to establish realis- 
tic linkages between A/s A, AES* A/33 and 163* and to tie in the collection 
activity with dieeeednatlng activities. 

i Precedence. In general* precedences are quite mil fora, and 
become revealing only when unusually high precedence from intercept stations 
tan be linked with significant enemy activity. This has occurred on a number 
of occasions. (See Xneloetare 2.) 

«. foruna. Traffic from intercept station* 1* also characterised 
bf an unusually high rate of rerun* cospared to ether military traffic. 

Although no particular intelligence significance la attached to this factor* 
it serves to Improve foreign Intercept coverage. 
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t. Traffic types. 8a*e4 an categorisation of traffic by type, and 
ldwat lflaat ion of the type#, each typ® be* characteristic® of its am . For 
exa mple, identification of era typo M weather veanlta In dotation that 
slroct &H wwather intercept® arc obtained at etatienc In the htcifle araa. 
The asmtptlon jfbllema that thia traffic consist® of encrypted weather trane- 
cdtaione fro* Asian stations, Although this analysis project did not Include 
scmitorlng of lnier-MMtssun lent Ion between intercept stations, it i* under*' 
Stood that copies of weather traffic intercepted at Qua.* (the largest source 
if such truffle forwarded to ATS A) ere forwarded to LlfEl this way 

Ve Interpreted as indicating the existence of a processing unit at that 
location f m assunption eepportad fay a flew ef traffic during Jtrnc trot a LGEI 
to Andrews AF9, known to he the headquarter a of t h « iir Fore* 'Teather Service. 

g* Cryptographic characteristic®. A study #f the eight-letter 
indicator® owed on scrambled test ravoale several «on-rando~ seleotiona. An 







occasional pair of wesassto with identical indicators wee found. Identical# 
in the first and eighth position® of individual indicator® otaurred at a rate 
IMP lever then expected render., suggesting that such eteurreac## are nc really 
suppressed but appear occasionally as violation* ef ttrypto-oporaUny instructions.. 
Thwro was a high rate of repetition of * given letter in the ease position of 
several consecutive indicator*. Frequency cerate on letters used per position 
per station per day reveal that station® way he grouped according to distinctive 
frequency distribution pattern®} that within thews group the pattern* for 
any one of the first six positions vary daily , although, a given pattern 
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recur In the seas position or in any other of tha first six positions} that, 
•lan within thseo groupings* the seventh position pattern is the sans from day 
%e day. Selection of the eighth letter appeared to be randan except for cveUk 
SRCo of letters identical to those used la the first position. 

(h) Operator efficiency and diealpline. Traffic eaasdned by pro- 
tadare analyst a tdelled 25*631 Messages, tfao overall ddsorep&acy average 
(C.X2 per «*ssag*} eoaepares favorably with the average of all Military 
station 9 (aero than ons per Message, 1 . Jjseodiato corrective action was taken 
m the More serious violations and practices as eKScgpllfied by Inclocurea 
% through 9 « 

xix. cooc'ur.itAfith.'- & «h> ruuteo activiti-^. 

4. SeUt loner, ip between *F 5 * sod the service cryptologic agencies 
having been established through eeaamle&tio&s associations (see paragraph $e 
She va) # valid assumptions concerning their respective functions ire mads on 
tiis basis of volu&ot and types at traffic* other ccsnunlcations contacts* 
jA&in language aaseegs s* and an abundance of unclassified eoilater&i inf or- 
station. The bulk of the non-intercept traffic esn he grouped into tUrae 
amjor categories on the basis of crypto nets, addroaaaa a t length* voices and 
direction of truffle. Cm of these deserves isauidiato consideration ia that 

7— —***. — m jsiesaa— „ " *- ■■■ tf -r^^^^aaweea wi , 

sufficient evidence is present to Indicate that its purpose- is the disstednar- 



tion Of CnCDff products, th rough analysis of volaas* precodeacae* amt 
addressees, sryptaaets in this group J»ay well provide foreign analysts with 



SA I n d e x to the mcmt of COWtSt aueest* enjoyed by AFSA, for exse^le* a 
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MtaR Iflcaat tmfiwm* in tb« volwae of Intercept traffic received frc* 



adh«mi*nt to th* iinrMdnn of Sosth tor** mi o wo onpon lod fcy * oanoidetmble 
taro**# ie traffic from Arlington EaJtl to CJ5 CFjJ # both in «•«•«£« voltw* and 
length. fr*o#4*ncea ru#e from root in* and priority to operational ioorndJUt* 
Mid «W 0 rf«rc 7 < fe e «o ooaaaaaa ooro iMMowd to contain iMaUtgmflco derived 
J ftrgm Sprth toraaa intercept and to# high proaodaacea indloatod that tho 
traffic moo of vital topertacoo to tfc* tactical afforta of tho V* 1% ferot*. 



flhia it «&t*d by mip of aamepla, for a flor>b«r of other aignlf leant and 
lofarmetlve pattern# mor# act*! in this typo of traffic* 2nold^t&lly> Cha 
•attar of pnwodaaoe# «** taken aj? ia wadla toly with tho originator* of bho 
traffic Involved *tth ih# roaolt that a aotioaablo lowering of procedanc# 
follow*}. Uto entire jemblan of oeewuale&tion* involved in 41 aaa^t nation ha# 
too am dtoetwurad at length «dth amnrlty rapraaoatativo# of isa and Cp-202, and 
it la hoped that «p«ratlooally foeaUalo cover p la n a can b# loplaawmtoi* 

imsenvs actid». 

I* fh» finding# rtport*^ ai»v* indicate ganar ally that tho security 
if JJf&A olootrlcal aeacanioationo la inado^aato. Ideally, protective action 
aw&d involve the removal of characteristic# #hioh pandt the aagregattoa 
if tfSA traffic and ibe identification of oddreea deeignatione* la* removal 
if thaoe oharaoteriotiom ia an octree# ly aooj&cK t rmmXmUtn security prob~ 

i«i aide* AfS* la faaad *dth tho took of restoring protection to m Identified 

* 

atgattliation rather than ini t ially oafcabUdhing protection for a mm organ ia*~ 
4 ion* i diaguia* ia needed and UR& aan affect thla dieguiao only by either 
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p##*in« it— It off a# on# or war* onr«l*t*d organlintiofta jr#s#nUjr J* 
«xl«t«0C9 or «« on# or *©ra now organisation# which c halltogt i#*ntlfle*tlon. 
2ft oaao, th# dl*afs>oara«9e« of th# praaont font of A FSA —muixl—tlmna 

«Mdd aolneid* with (*»d nay bo id#otlfl#d with) th# «atabli»h»#ftt of Afol 
Mwaa lMtlwyi in th* di#£oi**d fora. Th* pro hi «n, aoaowb&t #v#r#tspXifiod # 
if on# of hiding a 1 a*i« object within « amOX cbjwrt, *nd cannot bo r*»l?*d 
anlaaa both ohJ#et* an >in*i and all aa&«rnal foatur*# »f both bmcom 
iAmtiaul and un» pretectal* an ldnl oxa&pl* of each * *» Vat ion would bo 

on-lirw «ncry ption on ft troak circuit wad by AF&t «nd a old* variety 
mt oth ar *rganl**U#no. It la ecocluda! that It iaiopowaihl* tortwva 
•haracteriatic* which parsdt «egr«$aUon of AJTSA truffle or th# Idantlfication 
of AF&A ftddroM daalgwitlona, oalaao whol**ala changa* ora cwdo in th# ia&amal 
dharoatcrlatlea of nen~A?SA # ai or «lw fcho ympmn of if^A 
oloctrical eoamnleation# la op uni dftrably raduc*d« 

Dh#r*v«r po#a ihl*, AtaA-Gfc ha# tt*«c oorraoUr* aatloo on iodivldnaX 
«ip#*t# of th# ovmrmXl paroblwe* Etotii rath tin# u a practical solution to 
th# an tiro problem 1* advanced, fwpoaoa to aaintain atorvelUarus# and 

r ato m an d i#prov«o*at# on apaeifio aapaeta obaravor Indicatad* C oao wn ta and 
raoo a aton da tloaa on soaa «f th* iaharant cbaroateriatlo# which eon tribal* to 
th# oo ft plax l ty of tba probiro* but art —i&bl beyond th* accpo of AfbAH&4, 
wr# «ont«ln«d In th# r a tal nin e paraerapht* 

7# Xt 1« atroagiy r aoororo dad that th# ro^ulrwRsnt* for alottrioal 
tranawlaalcn of intercept data bo tarafulV r«rt#«»d by oropatont jwuraooaal 
Cttfcwt IDAS fBOSS BmsCftT kftCiOiD III rSOCUCTlCfc iCTimi^ add that nob 




i t+rUm be oa * continuing periodic basis) that procedures fee established, 

' «CO«egwjIed by Intensive persormel training, to facilitate raco&sl tion of 

aHjpLsttable date la ih« field) that rsqolrsssnts for traaesdesion. tgr 
electrical scans bo **d* wro realistic la tors* of asploitshUlty) th*t 
the possibility of establishing «A sxalmaively USA ecerier sartlee to handle 
♦fes volwws of dot* opt I sss dU toly «*ploli&ble bo thorou^ly invest lasted* 

1% to believed that • courier asrvic# could bo organised oa * sera affective, 
efficient, reliable m4 secure bools than Is possible under coacualcttisas 
Sondltioas sedating today* 

ft* the e*?pUi«yst«a oaed for the treasaissJUm of row intercupt to 
I Yftehingten Is considered barely adequate fro a tbs security standpoint* 
ftsslfft Stod as UXHi*kVA, it is a additive lay generator, pro- 

seating tbs possibilities of solution of pairs of ot**#*~o» in depth whether 
•r ftoi tbs *t>ioni are known, and, given tbs rstors, tbs possibility of 
Identifying sad setting tbs rotors sad switches to pcmil the read ! ag of 
traffic la tmo sryptoperlod if s rotor aULgamnt is traasaittsd la the else*** 
It is tfcere&rc recc«u#ude-l that the er/ptosystea kmm as If CUD (one tisw 
ass uf *S*K 2 - 1 ) > with tbs oAC-tlas pad indicator procedure proposed to 
AJTCU-C2 it» 4P2A-C4 fl/f dated 24 *wt# l?$v>, be rsoonsl dared for intercept 
VM> add that It ha plaeud la affect ss soon ee possible as an latsrln 
Spates ponding; the availability of tbs as AS % a cipher relatively lasuno 
ts depth reading and rseoastructisn. 

$• Any esats^plated cove of iitzk activities so aid provide the first 
real opportunity to over cos* inherent sottee aaes, particularly overt 





M«oel*ticn of aolleotion and prediction aatiaitiaa with diaaafrfnattni; 
acanelea. Ooawunieattor.a planning ahnald ba^ln «saaurr«itly with any 
aw r a want plana, fid toll conari deration should bo *i*«r, to transmission 
••eurlfc/ lnpliaattons. 

10* A nar* toeura preeodora has b**n daviaad far gr e w! din? 
Adantifiaattcm af traffic by typa, and la raady for diacmeaiwi, Sowcvar, it 
la fait that aty aactamal at£r«£&tl©n of traffic praaanta inharsnt #a«uritjr 
Aaeorilo/ly* it la strongly raaoaasw<S»d that AfSA~«2 and 
AfSA-13 rrriaw tha OKjaraaaad rtruilraeant far ao$r* 4 *llon and all 

fMtlbla solutions ba**4 on rfwislon af in-station handling praotlcaa fea 
♦owplstaly anhauatad in prafaraoco to a&atimdnfi tha prasant procodura ar 
Inst itut lug m nm pweadura. 
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TOTAL ttCSm-7-D TRAFFIC 70 tM 
«Jwno 15 - Julgr 15, 1950 
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Total*- 40,766 
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-19 ,xicu 

UgK~2D (CADH 

OSS-26 (FABB) 
BSifr-30 (PEBC) 

BSK- 31 A (icn) 
osH-ja ‘ 

034-33 
5»-3* 
osa-37 

GSA-3* 

uss-39 . < 

OStt-43 

SSH-45 (TOFF) 
S*-ASA PAC (H£OJ> 
Ri~A3A S® CTUDD) 
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SATA 

X1CI 
.nos 
(sabl) 
(ufla 
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*Tk> •arial nuab*r range* ran concurrently *c traffic cot of 101*0, 
•*Uxa*ting too ccparate originator*. yt& of the traffic ooo in a 
OCS-999 range and 444 vac in a 3001-3999 range. It one net p«**ifel* 
to ***ocl*t* ep eel fie range* with OSh-6 or U4#»31 aa anoh. 
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